Subject: Re: Remote Inbox login.

From: [email-masked] (David Krinsky)
Date: 02 Jan 1997 00:53:36 -0500

David Krinsky <[email-masked]> writes:

> However, many IMAP servers, including the U. Washington one, allow imap
> logins to be authenticated using rsh.  If /etc/imapd is a symlink to the

My apologies.  This should read "/etc/rimapd".

Dave.

---

From: Jungshik Shin <[email-masked]>
Date: 09 Jan 1997 16:12:50 -0500

> My apologies.  This should read "/etc/rimapd".

  Is there anyway to authenticate imap login using ssh instead of
rsh? My school computer doesn't allow rsh although it 
allows 'ssh'(secure shell). I tried using port remapping(?
or is it redirection?) feature of ssh, but it doesn't work. 
TIA for any help.

     Jungshik Shin

---

From: Mike Brudenell <[email-masked]>
Date: Tue, 14 Jan 1997 09:31:00 +0000 (GMT)

I'm not familiar with how ssh works, but I presume it can be used in a
manner similar to rsh?  That is, you can give a command of the form:

	ssh hostname command

If this is so then you can probably get a pre-authenticated session to
start by changing the C-client library used by Pine and the imapd.

Specifically,

1.  Determine the full path name of the ssh command (eg, "which ssh"
    should tell you)

2.  Edit the RSHPATH variable for your platform in the Makefile in the
    c-client source code directory to contain the full path name of your
    ssh program instead of that of rsh.

3.  Recompile, install the executables and test.

Disclaimer: it *might* work; I'm not familiar with ssh or the mechanism
imapd uses to determine the username validated by the rshd and hence
whether this will also work with the ssh daemon.

Cheers,

-- 
Mike Brudenell                                         <[email-masked]>
------------------------------------------------------------------------
The Computing Service, University of York, Heslington, York, YO1 5DD, UK
Tel: +44-1904-433811  FAX: +44-1904-433740  http://www.york.ac.uk/~pmb1/

---

From: Andrej Borsenkow <[email-masked]>
Date: Tue, 14 Jan 1997 13:16:26 +0300 (MSK)

On Tue, 14 Jan 1997, Mike Brudenell wrote:

>     ssh program instead of that of rsh> 

All above is correct. Actually usual ssh installations make rsh and
rlogin just links to ssh.

There is one problem with ssh (the question was posted once on this list
as well).

SSH is normally using authentication method which is much like PGP's. The
user on remote host has database with "public keys". When I use ssh to
login/execute a command, I am asked about the "passfrase"; it is then used
to get "private key" from "key ring" (they are tagged with user/host). I
use '"' because (although very much like) all these are _not_ the same as
in PGP. 

It means, when Pine starts ssh to execute /etc/rimapd, ssh will need to
ask me passfrase. What happens in this case? At least the display will be
mangled.

It is possible to use "secrity server" - it is a program which is started
at login, asks me about passfrase, keeps it and then passes it on to ssh
over open file descriptor/named pipe/temporary file - what a given OS
supports.

Also someone reported, that ssh takes significant time to verify request,
so Pine times out. I think, it happens, when sshd (ssh server) is started
from inetd by request - it computes session key on every invocation, and
it can take some time.

So, the main problem of ssh without security server is how to ask user
about passfrase.

greetings

-------------------------------------------------------------------------
Andrej Borsenkow 		Fax:   +7 (095) 252 01 05
SNI ITS Moscow			Tel:   +7 (095) 252 13 88

NERV:  borsenkow.msk		E-Mail: [email-masked]
-------------------------------------------------------------------------